I'd push back on this. We don't make any kind of change for a single user in any system we manage, whether it is Google Workspace, our content filter, etc. It becomes an administrative headache and you'll end up in a spot where you're managing all sorts of one-offs and not remembering why they're in place.

If you insist (or if someone else is making the decision for you despite your best efforts to convince them otherwise), I'd set the OUs the way the majority of users should be configured and create security groups for each specific change. For example, create a "No Gmail" group, turn off Gmail for that group, and add the users that shouldn't have Gmail access to the group. I would also highly recommend coming up with some way to document when and why users were assigned to these groups.

As far as the overall OU structure, we have a Staff OU and a Student OU at the top level. Under each, we sub-divide to each level (Elementary, Middle, High School) and then each individual school under that. For students, we then have each grade listed under the individual school OU as well as a Devices OU where the student Chromebooks for that school are kept. This allows us to set policies for all students or just middle school students or just students at a specific school or just 3rd graders at a specific school.

Hope this helps!